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We present a new protocol in which a secret multiqubit quantum state |^) is shared by n players 
and m controllers, where |^) is the encoding state of a quantum secret sharing scheme. The players 
may be considered as field agents responsible for carrying out a task, using the secret information 
encrypted in while the controllers are superiors who decide if and when the task should be carried 
out and who to do it. Our protocol only requires ancillary Bell states and Bell-basis measurements. 
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Cryptography is the art and science of concealing a secret message from unauthorized parties. At present 
the most widely used cryptographic system is the RSA public-key protocol invented by Rivest, Shamir, and 



Adleman in 1978 0. However the security of this protocol is not proven, other than the fact the it is very 
, hard to crack with our present knowledge of mathematics and technology. 

The idea of quantum cryptography was first proposed in the 1970's by Wiesner 0. In recent years, the field 
\ of quantum key distribution(QKD) has found many fruitful applications of quantum information theory 0. 
Moreover, secure distributions of secret cryptographic keys have been demonstrated in and outside scientific 
laboratories 0, IE IE 0- The first provably secure QKD protocol was constructed in 1984 by Bennett and 
BrassardJ| using polarized single photons. Quantum entanglement assisted QKD was first proposed by Ekert 
qq ' in 1991 |9(. Since then, many other QKD protocols have appeared in the literature. 

In 1979 Blakely H3 and Shamir [111 ] introduced the notion of secret sharing as a means of safeguarding 
cryptographic keys. The idea is as follows. Suppose Alice wants to send a secret message to a remote location, 
and she has a choice of sending it to either agent Bob or agent Charlie. In order to reduce the risk of possible 
leakage and misuse of the message, it is often safer for her to split the message into two shares and send 
them to Bob and Charlie separately, such that either one alone has absolutely no knowledge of the message. 
Bob and Charlie can reconstruct the original secret message if and only if they cooperate with each other. 
More generally, in a so-called (fc, rt)-threshold scheme, the secret is divided into n shares, such that any k of 
those shares can be used to reconstruct the secret, while any set of less than k shares contains absolutely no 
information about the secret at all. 

Quantum secret sharing (QSS) refers to the implementation of the secret sharing task outlined above using 
quantum mechanical resources. Hillery et al. 01 an d Karlsson et al. EH were the first to propose QSS 
protocols using respectively three-particle Greenberger-Horne-Zeilinger (GHZ) states and two-particle Bell 
states. Apart from quantum sharing of classical secrets, the idea has also been generalized to the sharing of 
secret quantum information |l2tll3lll4| . which is often referred to as "quantum state sharing" (also QSS). We 
shall mainly be concerned with this notion of QSS in this paper. Some recent theoretical works in this area 
can be found in Refs. HE EE 13 111 13 EE EH On the experimental side, a (2,3) threshold QSS protocol has 
been demonstrated in the continuous variable regime QSS using pseudo-GHZ states has been reported 
earlier [2E]. Recently, a three-party QSS scheme has also been demonstrated via four-photon entangled states 


Controlled quantum teleportation (CQT) is an extension of the original quantum teleportation protocol 
proposed by Bennett et al. [23 in 1993. The idea is to allow parties other than the receiver to have control 
over the successful completion of a teleportation process. In the first CQT protocol proposed by Karlsson 
et al. 26], an arbitrary single qubit state is teleported to two receivers using a GHZ state, such that only 
one of them can reconstruct the quantum state using classical information provided by the other. Recently 
quantum teleportation with multiparty control has also been proposed |27l l2el |29| . in which the receiver 
can fully recover the quantum state if all of the controllers cooperate by communicating the outcomes of their 
measurements to the receiver. Yang et al. and Zhang et al. [2^] considered the controlled teleportation of a 
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multiqubit product state, and Deng et al. 29] a two-qubit entangled state. Furthermore controlled probabilistic 
teleportation of one- and two-qubit states has also been studied lately [3(1 l3ll | . Recent experimental works on 
quantum teleportation can be found in Refs. |82l Is^L l34l l35l ] . 

Most of the discrete variable QSS protocols proposed in the literature are of the (n, n)-threshold type 
El III III 111 111 Hill A (2,3)-threshold scheme using qutrits can be found in Ref. [jj. In the continuous 
variable regime, general (fc, n)-threshold schemes are possible using optical interferometry 0,H(j. Typically 
shares of quantum information are distributed by teleportation or entanglement swapping via Bell or GHZ 
states established between the sender and the players. In ordinary QSS, after the completion of the distribution 
process, the fate of the secret quantum information is entirely left to the players. For example, in a (k, n)- 
threshold scheme, any k players may come together anytime, extract the quantum secret and use it to execute 
a certain task. This situation may not be desirable in many real world situations, especially when it is crucial 
that the extraction of the secret information (or the initiation of the subsequent actions) requires authorization 
from higher offices. For such cases, it is desirable to have a secret sharing protocol where it is impossible for the 
players to extract the secret information (even if all of them agree to cooperate) before obtaining authorization 
from superiors which we shall call "controllers" . 

In this paper, we propose a new protocol which may be viewed as a hybrid of QSS and CQT. We consider the 
following situation. The dealer Alice has a A-qubit state |\f r i...j\r) which encrypts a secret quantum information 
and it is to be shared by n < N players {B\,. . . ,B n ) and m < 2N controllers (Ci,. . . ,C m ). |^i...jv) can be 
the encoding state of any secret sharing scheme, and we shall not specify it explicitly here. After the shares 
are properly distributed, successful reconstruction of the quantum secret |£) depends on two conditions: (1) At 
least m* controllers must agree to release the classical information they hold (m* depends on how the classical 
shares are distributed; see below), and (2) a set of at least k players must collaborate to perform a joint 
operation on the qubits they possess. Such a protocol may be termed "controlled quantum secret sharing" 
(CQSS). 

It is easy to see that CQSS reduces to ordinary QSS if all the controllers make public the classical information 
they hold. Therefore the enco ding state \^i...n), together with its access structure, must satisfy the theorems 
on QSS obtained in Refs. Il5| . The existence of controllers in CQSS adds another dimension to ordinary 
QSS. In order to reconstruct the secret quantum information in CQSS, it is not sufficient that a minimum 
number of players agree to cooperate— they must first obtain authorization from the controllers. Note that the 
players and the controllers play asymmetric roles in a CQSS scheme: Namely the controllers hold no quantum 
shares, therefore their role is not to reconstruct the quantum secret themselves, but to control when it should 
be done and which players are assigned to do it. In QSS, there could also be asymmetry between the power 
of different players [T3. Hsj. and this feature can be retained in CQSS in the access structure of the encoding 
state l^i. ..jv)- CQSS protocols are useful in secure quantum communication networks. They are also useful 
in the real world situation where the players are field agents responsible for carrying out a certain task, using 
the secret information encrypted in j^i...^), and the controllers are superiors who decide if and when the task 
should be carried out and who to do it. 

Most proposals for multiparty QSS [3 H Q E E3 and teleportation [H EHH |H H2 with multiparty 
control require ancillary entangled states and/or collective measurements involving three or more qubits. In 
some cases the number of involved qubits increases with the N or m, making them difficult to implement by 
current technologies. In contrast, the CQSS scheme to be presented below requires only Bell-basis measure- 
ments and ancillary Bell states which are much easier to produce and purify. 

The first step of the protocol is to divide into n equal shares and distribute them to the n players. 

This can be achieved by entanglement swapping (or teleportation) as shown in Ref. |33|. The procedure is 
conceptually quite simple and we reproduce it below. To begin with, we define the four Bell states: 




where the singlet state \<p~^ v ) is also known as the Einstein-Podolsky-Rosen (EPR) state. We assume that the 
Alice shares at least one EPR |0~„. ) with each player Bi , so that the total number of EPR states shared 
between them is N. Similarly she shares at least one EPR state \(f>~.p.) with each controller Ci , and the total 
number is 27V. It is to be understood that qubits {/i^} and {cti} belong to Alice, qubits {i>i} and {Pi} belong 
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respectively to the players and controllers. We first show how to distribute (or teleport) qubit-1 of l^i...^) 
to Bx, as we shall see the procedure can be easily generalized to include other qubits. The state l^i...^) can 
always be cast in the form, 



|* 1 ...w) = o|0i)|$2...jv)+6|li)|*a.. 



.Nil 



(3) 



where \a\ 2 + \b\ 2 = 1, and |$2...jv) and |$ 2 N ) are normalized states of (TV — 1) qubits. Then we can write the 
product of |Wi...jv) and \4>^ lVl ) as 

\*i...n)\^- iVi ) =^[|^ 1 )(a|l„ 1 )|$2... j v)-&|0 I/1 )|$L.iv)) 
+ I^ 1 )(«|1, 1 )I^...jv) + 6|0 Vi )|$ 2 ... w )) 

- \<t>U)(a\0 Ul )\$ 2 ... N ) -b\l Vl )\^ N )) 

- l^ 1 )(«|0, 1 )|<i>2...iv)+6|l, 1 )|<f 2 ... J v))]. (4) 

Therefore a Bell-basis measurement by Alice on the pair of qubits (1, fix) will entangle 2?i's qubit-^i to the in- 
active group (2, . . . , TV), such that the resulting TV-qubit state depends on the outcome of Alice's measurement. 
Comparing with Eqs. @, we see that if Alice informs B\ of the outcome, then by a local unitary transforma- 
tion on qubit-fi, B\ can rotate the state of the TV-qubit group (vx, 2, . . . , TV) to \^ Ui ,2,...,n), which is exactly 
what we started out with except that Alice's qubit-1 has been replaced by Si's qubit-^i. The required unitary 
operators for the four possible outcomes (|<^ + ), \<p~), |</3 + ), \4>~)) are respectively (a z a x , a x , a z , I), where 

(5) 
(6) 

(7) 

Notice that the above procedure is entirely general, in the sense that it is independent of the state of the 
inactive qubits (2, . . . , TV). Accordingly it can be repeated on the other qubits until all of them are distributed 
to the players (Bx,- ■ ■ ,B n ). 

Upon completing the distribution process, Alice would have made TV Bell-basis measurements (one for each 
qubit in \^x...n)), and obtained TV Bell states, {lip 1 }, • • ■ , \ip N )}, where € {\c/>~), |</> + ), \<p~), \<p + )}- Hence 



a x = |0>(1| + |1>(0|, 
I = |0}(0| + |1)(1|. 



there is a one-to-one correspondence between the qubits in l^i...^) and the Bell states in the list j?/) 1 ) 
Each Bell state corresponds to two bits of classical information; for instance we may assign 



N\ 



00, |^ 
10, 



19' 



01, 

• 11. 



(8a) 
(8b) 



In an ordinary QSS scheme, the Bell-state information is given to the players, so that they know what unitary 
transformations to apply to their qubits in order to recover the original state |^). In contrast, for the CQSS 
protocol being considered here, Alice distributes the Bell-state information to the controllers (Ci,...,C m ) 
instead. She could do it quantum mechanically by teleporting the Bell states to the controllers using the same 
method described above. However it is simpler to just send the corresponding classical information as follows. 



Suppose Alice wants to send two bits (x, y) to d with whom she shares a pair of EPR states 



and 



\K 



From 



^ ot-i a 



(9) 



we see that a Bell-basis measurement by Alice on qubits a, and oi i will leave the (/3j,/30 pair in one of the Bell 
states on Cj's side. Moreover the resulting Bell states on both sides are random but identical. Hence by the 
convention given in Eq. JHj, Alice and Ci can obtain a pair of random bits (x', y') by independently performing 
a Bell-basis measurement on qubits (an, a'j) and (Pi, PI) respectively. After that Alice can announce the two-bit 
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information (x © x 1 , y © y') (modulo 2) over a public channel, and Ci will be able to decode the secret bits 
(x, y) since he knows (x' , y'). 

It is interesting to note that, instead of giving the two-bit information of a Bell state to one controller as 
described above, Alice could also choose to split the Bell state and have it shared by two controllers. Again 
this can be done by following the same procedure described earlier for the distribution of l^i...^). In this case, 
the two controllers involved must cooperate to make a join Bell-basis measurement on their qubits in order 
to identify the Bell state they share. Moreover if one of the controllers does not cooperate, then the other 
one can get absolutely no information about the Bell state ,42]. Consequently, each individual controller has 
no complete control over the release of the corresponding two-bit information. This option may be useful in 
circumstances where some controllers are of lower rank than others. This concludes the specification of our 
CQSS protocol. 

Consider the simplest case where each player receives one qubit, and each controller one set of two-bit Bell- 
state information (i.e., n = m = N). If any k controllers release their two-bit information, then the k players 
holding the corresponding qubits can collaborate to extract the secret information Hence the minimum 
number of consenting controllers is m* = k in this case. Obviously if all the controllers agree to release the 
information they hold, then any authorized set of k players can extract the secret. If one of the controllers 
withholds his two-bit information, then knowledge about the corresponding qubit is completely hidden from 
the players. This can be seen from Eq. Q. Let the two-bit information corresponding to the distribution 
of qubit-1 be withheld, then the state of the N qubits (i/j, 2, . . . , N) is an equal mixture of the four possible 
outcomes as shown in Eq. Q. The corresponding density matrix is given by 



where I Vx is the identity matrix for qubit- v\. Clearly p' N contains absolutely no information about qubit-1 in 
the original state |\&i...jv)- Hence if more than (n — k) controllers withhold their information, the quantum 
secret |£) is sealed, even if all the players agree to cooperate. 

In other situations where n = N but m < N, some controllers may receive more than one set of Bell-state 
information (two bits). Then a controller holding more than (n — k) sets would have veto power over the 
recovery of It follows that if everyone receives more than (n — k) sets, the recovery of |£) would require 
unanimous consent from all the controllers. In the special case where Alice keeps all the Bell-state information 
home, then she becomes the sole controller who can decide not only when to extract the secret information, 
but also which players are assigned to do so. Finally, if Alice discloses all the Bell state information to the 
players, then the result is an ordinary QSS scheme. 

If n = 1, then CQSS reduces to the controlled teleportation of l^i...^) with m controllers. Recently two 
CQT schemes with multiparty control have been proposed by Yang et al. [27| and Zhang et al. [28|. Both 
schemes considered only the controlled teleportation of a product state of N qubits, whereas our scheme 
can teleport an arbitrary AT-qubit entangled state. The scheme of Ref. [27j requires an ancillary multiqubit 
entangled state, which is difficult if not impossible to implement when the number of qubits or controllers 
becomes large. Ref. [28| also employs only ancillary Bell states, and Alice transmits her measurement results 
to the controllers via a public channel using pre-established secret keys. In our case Alice could split a Bell 
state and have it shared by two different controllers; this option may be useful in certain circumstances, but 
it is not available in Refs. |27ll2Sj or other CQT schemes. 

As with all entanglement based quantum protocols, the security of our scheme depends crucially on the 
quality of the quantum entanglement connections between Alice and the receivers (players and controllers). 
An important advantage of this type of schemes is that the set-up, purification, and checking of the shared 
EPR states can all be done prior to and independent of the scheme itself [381 HH l40l El) . In the CQSS 
protocol being considered here, Alice can conduct additional security checking during the distribution process 
by randomly inserting a number of decoy states \6j), with \6j) € {|0), |1), | + or), | — a:)} for example. With M 
decoy qubits, the state to be distributed becomes 



2^(l«| 2 |*2...iv)($2...iv| + |6| 2 |^...iv)(*2...ivl) ! 

^/, 1 Tr 1 |* 1 ... J v)(*i...jv|, 



(10) 



M 



I*; 



1...N+M 



>=i*i...*>ni*i>. 



(ii) 
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At the conclusion of the distribution process, Alice identifies the decoy qubits and asks the players to measure 
them in appropriate bases and report the results. Checking against her own record for discrepancies, Alice 
can detect the existence of eavesdroppers. With appropriate number of decoys, the chance of an eavesdropper 
escaping detection can be made as small as desired. Similarly Alice can check for eavesdropping activities 
between herself and the controllers. 

From the above discussions, it is clear that in order to implement our CQSS protocol, the sender Alice 
must first share N EPR states with the n < N players, and 2N EPR states with the m < 2N controllers. 
To distribute the the quantum shares to the players, Alice needs to make N Bell-basis measurements. A 
maximum of 2N Bell-basis measurements are required to send the Bell state information to the controllers (N 
measurements if she sends through classical channels only). Therefore, apart from classical communications, 
the whole distribution process requires 3iV shared EPR states and 2N — 3N Bell-basis measurements. Needless 
to say, extra resources would be needed if decoy qubits are employed. Typically, each decoy qubit would add 
one EPR state and one Bell-basis measurement to the resources requirement given above. 

In summary we have presented in this paper a new protocol which we call "controlled quantum secret sharing 
(CQSS)". In this protocol, the encoding state |^i...iv) is shared by n players and m controllers. After the 
completion of the distribution process, further action is to be initiated by the controllers by disclosing the 
classical information they hold, then an authorized set of players can proceed to extract the secret information 
as in ordinary secret sharing schemes. We recap the procedure as follows: 

1. The dealer Alice possesses a A^-qubit state |\^i..jv) which encodes a secret quantum information In 
addition she shares a total of N EPR states with n < N players {£>i,. . . and 2N EPR states with 
m < 2N controllers {Ci,. . . ,C m }. 

2. Alice divides 1 ^1 jy) into n shares, and distributes them to the players by entanglement swapping (or 
teleportation) [32|. In the process, she obtains N Bell states from the required Bell-basis measurements. 
Each Bell state corresponds to two bits of classical information. Normally Alice divides the Bell state 
information into m groups and transmits them to the controllers through encrypted classical channels. 
However if necessary Alice could also split any Bell state and have it shared by two different controllers. 

In real world applications, the players may be considered as field agents responsible for carrying out a task, 
using the secret information encrypted in |\&i..../v), and the controllers are superiors who decide if and when the 
task should be carried out and who to do it. Our protocol requires only ancillary EPR states and Bell-basis 
measurements, so that it is relatively simple to implement. 
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